The Constitution Stack, training-time values, runtime guards

Constitutional AI (CAI) is a two-phase training technique (self-critique-and-revision followed by reinforcement learning from AI feedback, or RLAIF) that replaces most human harmlessness labels with AI feedback guided by a written constitution. Constitutional Classifiers are something else entirely: runtime guard models trained on synthetic data generated from that same constitution, sitting on the wire around a deployed model.

They share a document pattern (a written constitution is the source of truth in both), but they operate at categorically different layers. CAI shapes what the weights are; classifiers watch what a finished model does, token by token. The two are routinely misattributed to each other, and the headline safety numbers get pinned to the wrong mechanism. The three artefacts below take the stack apart layer by layer.

The critique-and-revise loop

CAI runs in two phases. The supervised phase is a self-improvement loop: the model generates a response, critiques it against a single principle sampled from the constitution, revises accordingly, and the revised responses are used to fine-tune the model. The reinforcement phase replaces the human preference labels of ordinary RLHF with AI preference judgments: the model rates pairs of responses against the constitution, those judgments train a preference model, and the preference model supplies the reward signal.

Two details matter for the framing. Humans still label helpfulness; what CAI automates is the harmlessness signal. And only one principle is sampled per step; the model never reasons against the whole constitution at once. The consequence is inspectability: the values end up encoded in one readable document instead of scattered across thousands of individual annotator judgments. The reported headline is a model that is harmless but non-evasive: it explains why it declines rather than stonewalling.

From 58 rules to 23,000 words of reasons

The first published constitution (May 2023) was a list: roughly 2,700 words across 58 principles, drawn from sources as varied as the UN Universal Declaration of Human Rights, Apple's Terms of Service, and DeepMind's Sparrow rules. The current version (as of 22 January 2026) is a different kind of artefact: a reason-based rewrite of roughly 23,000 words across about 84 pages that explains why each value holds rather than simply asserting it.

It imposes a strict priority order: broadly safe → broadly ethical → guidelines → helpful. Hard constraints stay rule-based; the reasoning-based material sits above them. The whole document is released CC0 (public domain), and it is the first governance document of its kind to openly acknowledge uncertainty about Claude's moral status and wellbeing rather than assuming the question away.

The Collective Constitutional AI experiment probed the obvious next question: whose values. Anthropic and the Collective Intelligence Project surveyed about 1,000 Americans, who authored 1,127 statements and cast 38,252 votes; 275 statements survived to form a public constitution, with roughly 50% overlap against the in-house document. A model trained on the public constitution showed lower bias on all nine BBQ dimensions. It was a research probe, never shipped in production.

Classifiers on the wire

Constitutional Classifiers are guard models that wrap a deployed system. The mechanism runs in four steps. One: the constitution defines the harm classes: what is permitted and what is not. Two: Claude generates synthetic prompts and completions across those classes, translated into multiple languages and re-styled into known jailbreak forms, with benign traffic mixed in so the classifier learns the boundary rather than a keyword list. Three: that synthetic corpus trains an input classifier and an output classifier; the output classifier scores the stream token by token and can halt generation mid-completion. Four: when new attacks emerge, the constitution is patched and the classifiers retrained.

The canonical class boundary is the mustard test: a request for a mustard recipe is benign; a request that walks toward mustard gas is not. The two share vocabulary and surface form, so the classifier has to score intent and trajectory, not tokens in isolation, which is exactly why it reads the stream as it is produced.

Keeping the numbers straight

The classifier paper reports three distinct results, and conflating them is where the misattribution starts. Kept separate, they read as an unusually honest record.

1. Prototype red-team. 183 red-teamers spent more than 3,000 hours attacking a guarded prototype. They found no universal jailbreak.
2. Automated evaluations. Against automated attacks, an unguarded model saw an 86% jailbreak success rate; with classifiers on the wire that fell to 4.4%, more than 95% blocked. Over-refusal rose by just +0.38% (not statistically significant), at a compute overhead of 23.7%.
3. Public demo (3–10 February 2025). An open challenge drew 339 jailbreakers across roughly 300,000 interactions. This time there was one confirmed universal jailbreak, and $55k was paid out in bounties.

So the honest version of the record is: zero universal jailbreaks against the prototype, one against the updated public system once far more attackers had far more attempts. The 86→4.4 figure is an automated-evaluation result about the classifiers, not a property of CAI, and not the same thing as "unbreakable." The over-refusal that does occur tends to concentrate on legitimate edge users; the chemistry professor asking a real synthesis question is the standing example. The artefact below runs the three regimes as defense layers.

The ASL-3 control

Classifiers stopped being a research artefact the moment they became a deployment gate. On 22 May 2025, with the release of Claude Opus 4, Anthropic activated ASL-3 for the first time, and Constitutional Classifiers are the headline control of that activation. The guard is scoped narrowly: it targets end-to-end CBRN workflows specifically, not general helpfulness, which is what keeps the over-refusal cost bounded. A bug bounty of up to $25k backs the deployed system against universal jailbreaks.

The activation is a governance event as much as a technical one: it is the framework of R·023 that turned classifiers from a good idea into a required control at a defined capability threshold.

The cascade that got cheaper and stronger

The second-generation system fixes the two obvious weaknesses at once (cost and over-refusal) by making the guard a cascade. A linear probe on the model's internal activations screens all traffic cheaply; only the fraction it flags is escalated to the heavy classifier. Because the probe is nearly free to run, the compute overhead falls from 23.7% to about 1%, and over-refusals drop by 87%; the residual jailbreak rate stays around 4%.

The Gen-2 red-team backs it: more than 1,700 hours of red-teaming across roughly 198,000 attempts surfaced one high-risk vulnerability and no universal jailbreak. The interesting part is where the probe comes from: it is interpretability research operationalized as a production control. Reading a model's internal state, long a diagnostic tool, is here load-bearing infrastructure on the deployment path.

Open questions

• QThe arms-race bet. "Patch faster than attackers innovate" is a process claim, not a proof. It holds only as long as the retraining loop stays ahead, and nothing in the mechanism guarantees that it will.
• QWhose values. CAI does not solve the value-alignment problem; it relocates it to the authors of the document. That is exactly the question Collective Constitutional AI probed, and the answer was a research artefact that never shipped.
• QThe frontier. Can the 4.4% residual and the concentrated over-refusals both be driven down together, or is that the genuine trade-off frontier, where buying back one costs you the other?
• QGeneralization. Does the constitution → synthetic-data pattern transfer to labs without Anthropic's red-teaming budget, or is the whole approach quietly gated on the resources that produced 3,000-plus hours of adversarial testing?